# Standalone outbound compute-node agent for a remote GPU server.
services:
  node-agent:
    # Production operators set MODELFORGE_NODE_AGENT_IMAGE to an immutable release tag or digest.
    # The non-floating `local` fallback preserves the source-build workflow without ever selecting
    # `latest` implicitly.
    image: ${MODELFORGE_NODE_AGENT_IMAGE:-modelforge-node-agent:${MODELFORGE_VERSION:-local}}
    build:
      context: .
      dockerfile: node-agent/Dockerfile
      args:
        # Without these the Dockerfile falls back to version 0.0.0 and empty revision/created
        # labels, so a Compose-built agent carries no provenance at all while still being tagged
        # with whatever MODELFORGE_VERSION happened to be set to. That is how production ended up
        # running an image tagged 1.1.1 whose contents were 1.2.0.
        MODELFORGE_VERSION: ${MODELFORGE_VERSION:-0.0.0}
        MODELFORGE_COMMIT: ${MODELFORGE_COMMIT:-}
        MODELFORGE_BUILT_AT: ${MODELFORGE_BUILT_AT:-}
    hostname: ${MODELFORGE_AGENT_HOSTNAME:-modelforge-node-agent}
    env_file:
      - path: .env
        required: false
    environment:
      MODELFORGE_AGENT_CONTROL_PLANE_URL: ${MODELFORGE_AGENT_CONTROL_PLANE_URL:-https://modelforge.example.invalid}
      MODELFORGE_AGENT_ENROLLMENT_TOKEN: ${MODELFORGE_AGENT_ENROLLMENT_TOKEN:-}
      MODELFORGE_AGENT_DISPLAY_NAME: ${MODELFORGE_AGENT_DISPLAY_NAME:-}
      MODELFORGE_AGENT_IDENTITY_MODE: persisted
      MODELFORGE_AGENT_ACCELERATOR_MODE: ${MODELFORGE_AGENT_ACCELERATOR_MODE:-nvidia}
      MODELFORGE_AGENT_IDENTITY_FILE: /data/state/node-id
      MODELFORGE_AGENT_CREDENTIAL_FILE: /data/state/node-credential
      MODELFORGE_AGENT_STATE_FILE: /data/state/agent-state.json
      MODELFORGE_AGENT_TLS_VERIFY: ${MODELFORGE_AGENT_TLS_VERIFY:-true}
      MODELFORGE_AGENT_HF_TOKEN: ${MODELFORGE_HF_TOKEN:-}
    volumes:
      - ${MODELFORGE_AGENT_STATE_VOLUME:-node-agent-state}:/data/state
      - ${MODELFORGE_AGENT_HF_CACHE_VOLUME:-hf-cache}:/data/hf-cache
      - ${MODELFORGE_AGENT_ARTIFACT_VOLUME:-model-artifacts}:/data/artifacts
      - ${MODELFORGE_AGENT_QUARANTINE_VOLUME:-quarantine}:/data/quarantine
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]

volumes:
  node-agent-state:
  hf-cache:
  model-artifacts:
  quarantine: